SQL injection vulnerability in Sentrifugo

The impact of this SQL injection vulnerability is severe. A successful exploit allows an attacker to bypass authentication and authorization controls, directly querying the underlying database. This could result in the complete compromise of sensitive data, including user credentials, financial information, and business-critical reports. The attacker could potentially modify or delete data, leading to data integrity issues and operational disruption. Given the ease of SQL injection exploitation, this vulnerability presents a significant risk, especially if the database contains sensitive information or is exposed to the internet. While no direct precedent is immediately obvious, the potential for widespread data compromise mirrors the impact of other high-profile SQL injection attacks.

Organizations using Sentrifugo 3.2 in production environments are at significant risk. Particularly vulnerable are deployments where the application is exposed directly to the internet or shares a network with other sensitive systems. Shared hosting environments where multiple users share the same Sentrifugo instance are also at increased risk, as a compromise of one user's account could potentially lead to the compromise of the entire system.

• php: Examine web server access logs for requests to /sentrifugo/index.php/reports/businessunits/format/html with unusual or malformed 'bunitname' parameters. Look for patterns indicative of SQL injection attempts (e.g., ' OR 1=1 --). • generic web: Use curl to test the endpoint with various SQL injection payloads: curl 'http://your-sentrifugo-server/sentrifugo/index.php/reports/businessunits/format/html?bunitname=test' OR 1=1 -- • database (mysql): If database access is possible, check for unusual or unauthorized database queries in the MySQL error logs. Look for queries that might have been injected by an attacker. • generic web: Review error logs for database connection errors or SQL syntax errors that might indicate an attempted injection.

1. 2024-03-21Disclosure

   disclosure

2. 2024-03-21Patch

   patch

1. Reservado2024-03-21
2. Publicada2024-03-21
3. Modificada2025-04-10
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-29873 is to immediately upgrade Sentrifugo to version 3.2.1 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. Input validation and sanitization on the 'bunitname' parameter are crucial. Web application firewalls (WAFs) configured to detect and block SQL injection attempts can provide an additional layer of defense. Monitor database logs for suspicious SQL queries that might indicate an attempted exploitation. Restrict database user permissions to the minimum necessary for Sentrifugo’s operation. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection payload on the affected endpoint and verifying that it is properly sanitized.